high7.5
CVE-2011-2149
Multiple SQL injection vulnerabilities in the SmarterTools SmarterStats 6.0 web server allow remote attackers to execute arbitrary SQL commands via certain par…
Impact
Multiple SQL injection vulnerabilities in the SmarterTools SmarterStats 6.0 web server allow remote attackers to execute arbitrary SQL commands via certain parameters to (1) Admin/frmSite.aspx, (2) Default.aspx, (3) Services/SiteAdmin.asmx, or (4) Client/frmViewReports.aspx; certain cookies to (5) Services/SiteAdmin.asmx or (6) login.aspx; the Referer HTTP header to (7) Services/SiteAdmin.asmx or (8) login.aspx; or (9) the User-Agent HTTP header to Services/SiteAdmin.asmx.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Smartertools | Smarterstats | Version 6.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.kb.cert.org/vuls/id/240150
- http://www.kb.cert.org/vuls/id/MORO-8GYQR4
- http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67833
- http://www.kb.cert.org/vuls/id/240150
- http://www.kb.cert.org/vuls/id/MORO-8GYQR4
- http://xss.cx/examples/smarterstats-60-oscommandinjection-directorytraversal-xml-sqlinjection.html.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67833